registry / triflux / 10.41.1

triflux@10.41.1

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Static inspection found powerful CLI behavior, but it is consistent with triflux's advertised AI-orchestration purpose and is activated by explicit user commands rather than npm lifecycle or import-time code. No credential theft, destructive behavior, persistence abuse, or attacker-controlled exfiltration endpoint was confirmed.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs triflux/tfx setup, doctor --fix, update, hub, or orchestration commands.

Impact

Expected local config changes and local/declared service communication; no confirmed unconsented execution or exfiltration.

Mechanism

User-invoked local AI tooling configuration and process orchestration.

AI rationale

Evidence

package.jsonbin/triflux.mjsscripts/setup.mjsscripts/lib/mcp-guard-engine.mjshub/team/synapse-http.mjsbin/tfx-live.mjsbin/tfx-setup-tui.mjsconfig/mcp-registry.json~/.claude/settings.json~/.claude/scripts/tfx-route.sh~/.claude/hud/hud-qos-status.mjs~/.codex/config.toml~/.claude/CLAUDE.md~/.claude/.tfx-hub-token

Network endpoints7

127.0.0.1:27888127.0.0.1:27888/mcpgithub.com/tellang/trifluxregistry.npmjs.org/trifluxmcp.context7.com/mcpmcp.exa.ai/mcpmcp.tavily.com/mcp

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

bin/triflux.mjs and scripts/setup.mjs can modify Claude/Codex/MCP config when user runs setup/doctor --fix.
scripts/setup.mjs can register Claude hooks and statusLine commands for triflux orchestration.
bin/triflux.mjs has user-invoked update/doctor paths that run npm, git, brew, or local CLIs.

Evidence against

package.json defines bin entrypoints but no preinstall/install/postinstall lifecycle scripts.
Network use is package-aligned: loopback hub health/MCP, GitHub star/update checks, npm registry update checks, and configured MCP endpoints.
hub/team/synapse-http.mjs posts only to configured/loopback hub and uses TFX_HUB_TOKEN or ~/.claude/.tfx-hub-token for local hub auth.
No source evidence of credential harvesting or exfiltration to attacker-controlled endpoints.
Shell/child_process use is CLI-driven for diagnostics, setup, tmux/ssh orchestration, update, and optional dependency repair.
AI-agent config writes are tied to explicit setup/doctor/sync commands, not install-time or import-time execution.

Behavioral surface

Source

Source & flagged code

9 flagged

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { realpathSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import { mkdir, readFile, rm, writeFile } from "node:fs/promises";

5import { homedir, tmpdir } from "node:os";

6import { join as pathJoin, resolve as pathResolve } from "node:path";

7import { fileURLToPath } from "node:url";

8import { promisify } from "node:util";

9import { runHygiene } from "../cto/hygiene.mjs";

10import { notifyCtoHygieneOnce } from "../cto/hygiene-notify.mjs";

11import { createNotifier } from "../hub/team/notify.mjs";

12import {

13 escapePwshSingleQuoted as escapeRemotePwshSingleQuoted,

14 probeRemoteEnv as probeRemoteHostEnv,

15 shellQuote as remoteShellQuote,

16 validateHost as validateRemoteHost,

17} from "../hub/team/remote-session.mjs";

19const execFileAsync = promisify(execFile);

21const DEFAULT_SETTLE_MS = 1500;

bin/triflux.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { setTimeout as delay } from "node:timers/promises";

3import { execFileSync, execSync, spawn } from "child_process";

4// triflux CLI — setup, doctor, version

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/triflux.mjsView on unpkg · L2

bin/tfx-setup-tui.mjsView file

Lines 1-8javascript

1#!/usr/bin/env node

2import { dirname, join } from "node:path";

3// tfx-setup-tui — Interactive Setup Wizard TUI entry point

4import { fileURLToPath } from "node:url";

6const root = dirname

hooks/hook-orchestrator.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

3// hooks/hook-orchestrator.mjs — 범용 훅 체이닝 엔진

4//

5// settings.json에 이벤트당 하나만 등록. stdin JSON에서 이벤트명+툴명을 읽고

6// hook-registry.json의 우선순위대로 훅을 순차 실행한다.

7//

8// 실행 규칙:

9// - priority 낮을수록 먼저 실행 (triflux=0, omc=50, external=100)

10// - blocking:true 훅이 exit 2 반환 → 즉시 중단, 이후 훅 건너뜀

11// - 출력(stdout JSON)은 마지막 유효 출력으로 머지

hub/team/synapse-http.mjsView file

Lines 1-28javascript

1import { readFileSync } from "node:fs";

2import { homedir } from "node:os";

3import { join } from "node:path";

5const HUB_DEFAULT_PORT =

scripts/completions/tfx.zshView file

•path = scripts/completions/tfx.zsh kind = build_helper sizeBytes = 4853 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/completions/tfx.zshView on unpkg

Source & flagged code

9 flagged · loading source

bin/tfx-live.mjsView file

1#!/usr/bin/env node L2: import { execFile } from "node:child_process"; L3: import { realpathSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

bin/triflux.mjsView file

2158L2159: // ── psmux 기본 셸 자동 수정 (cmd.exe → PowerShell) ── L2160: if (process.platform === "win32" && which("psmux")) {

High

Shell

Package source references shell execution.

bin/triflux.mjsView on unpkg · L2158

2293if (existsSync(join(PKG_ROOT, "hub", "server.mjs"))) { L2294: const defaultHubUrl = `http://127.0.0.1:${process.env.TFX_HUB_PORT || "27888"}/mcp`; L2295: autoRegisterMcp(defaultHubUrl, { codexEnabled: false }); ... L2304: const script = join(PKG_ROOT, "scripts", "setup.mjs"); L2305: execFileSync( L2306: process.execPath,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Findings

5 High6 Medium4 Low

HighChild Processbin/tfx-live.mjs

HighShellbin/triflux.mjs

HighSame File Env Network Executionbin/triflux.mjs

HighCredential Exfiltrationhub/team/synapse-http.mjs

HighRuntime Package Installbin/triflux.mjs

MediumDynamic Requirebin/tfx-setup-tui.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/triflux.mjs

MediumShips Build Helperscripts/completions/tfx.zsh

MediumStructural Risk Force Deep Review

LowWeak Cryptohooks/hook-orchestrator.mjs

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to triflux@10.41.1.

See all versions of triflux for other recorded verdicts.

Review the evidence and your use of triflux@10.41.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-01 05:41:17.557Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.